This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to perform cross-site scripting via manipulation of the 'subject' argument in the /subject1.php file. The vulnerability is classified as medium severity with a CVSS 4.0 score of 5.3, indicating network attack vector, low attack complexity, no privileges required, but user interaction is necessary. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. No vendor advisory or patch information is available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when they interact with the vulnerable parameter, potentially leading to session hijacking, defacement, or other client-side attacks. The attack requires user interaction and does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should apply standard XSS mitigations such as input validation and output encoding on the 'subject' parameter. Monitor vendor channels for official fixes.